Campaigns

Overview

The campaigns page is an overview of all campaigns.

Click on a campaign name to open a page with more information.

Campaign overview

The campaign page holds statistics, event timeline, information and actions available for the campaign and its recipients.

Campaign Top Cards

The cards on the top of a campaign page shows quick statistics for the campaign.

You can click on a statistic on card to see it compared with other cards.

Campaign Timeline

The campaign timeline is a interactive visualization of the events of a campaign.

Double click or scroll on to zoom in.

Hover over an event to see details about it.

Click 12h or 24h to switch beteen 12 and 24 hour time format.

Click Reset View to zoom out to the entire campaign timeline.

Campaign details and actions

The details section gives you a quick overview of all the campaign details and actions available on campaign level.

Click the Template for a visualization and information about the template used in the campaign.

To manage a campaign, use the campaign actions:

Campaign event table

Use the events table to get an overview of the events.

Campaign recipient table

The campaign recipients table, gives an overview of the recipients of a campaign.

The Status column shows the most notable event for the campaign recipient.

Use campaign recipient Actions to manually handle delivery or see all events for the specific campaign.

Click on a recipient to view the timeline for the recipient:

Create a campaign

A campaign is a single phishing operation.

Prerequisites for creating a campaign is a complete template and at least one recipient group.

1. Start creating a new campaign by clicking New campaign on the campaigns page.

   

   New campaign - Step 1

   Field	Description
   Name	The name of the campaign.
   Template	The template to use for the campaign.
   Type	A test campaign does not count into statistics and is labeled with a test label.

2. Set the recipients groups that should be included in the campaign.

   

   The number besides each group, represents the number of recipients in that group.
   Each unique recipient is only included once, even if they are in multiple groups.

3. Setup how the campaigns delivery is done by selecting a Delivery Method.

   

   • A Time Box schedule evenly distributes sending between the selected Delivery start and Delivery end.

     

     Time box

     Field	Description
     Delivery start	The delivery start date and time of the campaign.
     Delivery end	The delivery end date and time of the campaign.
     Delivery sort by	Sort the sending order by a recipient column such as department.
     Delivery sort by	Set the sort order of the selected Delivery sort by.
     Delivery sort order	Set the sort order of the selected Delivery sort order.
     Close campaign	When to automatically close the campaign and set it to completed. When a campaign is completed, recipients can not longer interact with it.
     Anonymize data	Closes the campaign and anonymizes all data related to it. Anoymization will not delete campaign statistics, but it will no longer be possible to collate an event to a recipient.

   • Use Daily Slots delivery method to select specific week days and delivery hours.

     For example monday to friday between 08:00 (8am) and 16:00 (4pm).

     

     Daily Slots

     Field	Description
     Delivery start and end	The start and end date of the campaign.
     Delivery by	Sort the sending order by a recipient column such as department.
     Delivery order	Set the sort order of the selected Delivery sort by.
     Delivery days	The week days to restrict delivery to.
     Delivery hours	The hours of the day to deliver within.
     Close campaign	When to automatically close the campaign and set it to completed. When a campaign is completed, recipients can not longer interact with it.
     Anonymize data	Closes the campaign and anonymizes all data related to it. Anonymization will not delete campaign statistics, but it will no longer be possible to collate an event to a recipient.

4. In a Self Managed campaigns, no delivery start and end is set for the campaign.
   Instead the campaign manager can copy e-mail contents or landing page urls and delivery it to their recipient themself, this could be in a snail mail or via. 3. party system.

   

   Self Managed

   Field	Description
   Close campaign	When to automatically close the campaign and set it to completed. When a campaign is completed, recipients can not longer interact with it.
   Anonymize data	Closes the campaign and anonymizes all data related to it. Anoymization will not delete campaign statistics but it will nolonger be possible to collate an event to a recipient.

Set extra options for the campaign.

Miscellaneous

Field	Description	Only in Red Team edition
Save submitted data	Should the data entered by the recipients on the phishing page be stored?	YES
IP filtering	Should the phishing pages only be filted by IP allow or deny listing?	YES
Web hook	Use webhhok to send campaign events.	NO

Finally review the campaign before creating, if everything looks good - click Create

Templates

A template is a reusable collection of a domain, smtp sender or api sender, email and landing pages.

Templates Overview

The templates overview contains all available templates.

Create template

Prerequisites for creating a template is:

• Domain
• SMTP sender or a API sender
• Email
• Landing page

Click New Template on the templates page to begin.

The page flow is the funnel that the recipient goes through after clicking the lure link in the email.
The page flow can consist of one or multiple pages.

IP Filters

IP filters help ensure that the right recipients can access a phishing page and are selected when setting up new campaign. A Deny page can also be configured to show different content to a not allowed visitor.

Lists can be added configuring a new campaign at the Schedule - Miscellaneous section.

Create IP Filter

Web hooks

Webhooks are used to communicate campaign events to 3. party APIs.
A Webhook call is fired when a campaign event is triggered.
This can be useful for functionality such as notifications.

Accept-Encoding: gzip
User-Agent: Go-http-client
Content-Length: 142
Content-Type: application/json
X-Signature: 3ec2d0d777495b4410331a8e22de309e393761ed2e16f4271577e812ffaf26e3

{
  "time":"2025-03-30T12:13:00.026471259Z",
  "campaignName":"Example",
  "email":"[email protected]",
  "event":"campaign_recipient_message_sent"
}
			

A webhook is fired for the following events.

Verifying webhook

The webhooks has a optional signature method that can be used to verify that the webhook was sent by Phishing Club.

When creating a webhook, a field named Secret can be used to add a header to the webhook request with they key X-Signature

The X-Signature contains body of the request signed with HMAC256.

The following Go code is an example of verifying the X-Signature.

bodyBytes, err := io.ReadAll(body)
if err != nil {
  log.Println("failed to read body for HMAC calculation:", err)
  http.Error(w, "failed to read body", http.StatusInternalServerError)
  return
}
h := hmac.New(sha256.New, []byte("SECRET_KEY_HERE"))
h.Write(bodyBytes)
calculatedHMAC := hex.EncodeToString(h.Sum(nil))
// Get the signature from the header
signature := req.Header.Get("x-signature")
if calculatedHMAC != signature {
  http.Error(w, "invalid HMAC signature", http.StatusForbidden)
  return
}
			

If no secret is used, the X-Signature value will be UNSIGNED.

Create webhook